McKinsey Quarterly

Learning from financial regulation’s mistakes

| Article

The G-20 meeting in London earlier this year set the direction for reforming the regulation of financial services to prevent a recurrence of the present crisis. Still to come is the hard work of hammering out the details, which will determine if a new regulatory system can succeed—without imposing excessive costs or triggering unintended consequences.

The causes of the current crisis resemble those of many previous ones: banks that didn’t have enough capital lent too much, too easily, relying on wholesale funding that disappeared when the inevitable concerns about asset quality arose. Yet there are important differences this time. The current problem started in what were regarded as the world’s safest and most sophisticated markets and spread globally, carried by securities and derivatives that were thought to make the financial system safer.

If regulators working on solutions resist the reflex to build incrementally on conventional wisdom and existing structures, we now have an opportunity to reshape the global regulatory system fundamentally. That will require a dispassionate assessment of the reasons for the current system’s failure. The difficult issues regulators must address include the appropriate degree of protection for financial institutions, the regulation of nonbank entities (such as hedge funds), and the determination of adequate capital levels. Brave—even radical—changes may be necessary.

Tackling ‘too big to fail’

A large bank’s failure poses risks to other institutions, the financial system, and the broader economy. For this reason, regulators often step in to protect not only the bank’s depositors but also all its creditors (and sometimes shareholders) from losses they would otherwise face. Banks for which governments are likely to intervene are seen as “too big to fail” (TBTF). While this kind of protection solves the immediate problem, it increases longer-term systemic risk because creditors or investors have less reason to monitor banks they see as TBTF, and the managers of these banks have a greater incentive to take risks. Governments tried to mitigate this element of moral hazard by being deliberately ambiguous about which banks they would rescue and on what terms, but the recent rescues obliterated this ambiguity, and the world now believes that no large financial institution—bank or nonbank—will be allowed to fail in the way nonfinancial companies do.

Most proposals to address the TBTF problem, from the G-20 and others, recommend regulating and supervising large, complex financial institutions more tightly. Yet the clear message of economic history is that incentives overpower regulation. Measures are needed to prevent, or at least discourage, institutions from becoming too big to fail in the first place and to wind them down if they do. Several actions could be taken to prevent them from becoming so big that they create systemic risks. It may be possible to use antitrust approaches originally designed to prevent markets from becoming too concentrated. Additional capital charges or insurance fees on institutions could be levied in proportion to the level of systemic risk they pose—in effect, charging them a market price for the TBTF guarantee. Stronger national-level regulation of the subsidiaries and branches of international banks could ensure that the impact of their failure was contained. Finally, investment banking and commercial banking could be kept more separate than they are now.

Besides prevention, we need a cure—a system for liquidating large banks in a way that controls systemic risk but still ensures that investors, creditors, and managers bear sufficient pain to eradicate moral hazard. The United States has a tried-and-tested bank wind-down process, but it is designed for straightforward domestic commercial banking and would need to be adapted for more complex and global institutions. Lessons from the troubles of AIG and Lehman Brothers could help to design such a process. Creative ideas have been proposed for handling failures by immediately transferring good assets to a new, smaller but shiny “bridge bank.” That would leave uninsured creditors with not only a “bad bank” holding troubled assets but also some equity in the new institution.1

It is not clear whether governments coping with the present crisis were right to rescue and continue to support so many banks. But incentives matter: no matter how big banks are regulated, there will be many more failures if they always expect to be bailed out.

Mitigating universal-bank risks

Conducting commercial- and investment-banking activities in a single institution is a variant of the TBTF problem, but one that requires its own remedies. Commercial and investment banks have different risk profiles. Commercial banks create credit vital to the real economy yet are inherently fragile: if all depositors want their money back at the same time, any bank will go broke. Governments therefore insure retail depositors, central banks act as lenders of last resort, and banks submit to regulation, supervision, and the maintenance of minimum levels of capital. Investment banks too support the economy by helping companies raise capital and maintaining liquidity. But to do so, these institutions trade actively in the capital markets, where bubbles and crashes are endemic and, as a result, the rewards and risks are commensurately bigger than those of commercial banks.

There are economic advantages to be had from combining commercial and investment banks, and the prevailing wisdom has been that any risks from doing so can be controlled. The current crisis has presented no evidence that combined (or “universal”) banks are more vulnerable or blameworthy than pure investment or pure commercial ones. But the crucial point is that combining the two kinds of institutions extended the protection given to commercial banks to investment banking, artificially reducing its cost of capital. That encouraged the growth of larger, more complex institutions and transferred to taxpayers costs and risks that no one had contemplated.

Ignoring this downside would be a mistake, as would peremptory regulation to separate investment and commercial banking. We need a balanced reappraisal of the advantages and disadvantages of universal banking. Even if there is no justification for untangling commercial- and investment-banking activities, stronger firewalls may be required between them, at least for deposit insurance and government guarantees.

Regulating nonbanks

One thrust of the G-20 agenda is the extension of regulatory oversight to institutions in what has become known as the “shadow banking system,” such as hedge funds, private-equity funds, insurance companies, and off-balance-sheet vehicles. Such moves are undoubtedly necessary but should be made cautiously.

First, regulation imposes real costs on society. In particular, prudential regulation creates anticompetitive economies of scale, impairs innovation, adds costs, helps preserve weak management and business models, and passes the pain on to taxpayers if institutions falter. Second, few if any hedge and private-equity funds actually present systemic risk. The unique feature of banks (and some of their off-balance-sheet vehicles) is that many of their liabilities must be repaid on demand and that any failure to do so has a falling-domino effect. Virtually all other financial institutions, by contrast, tend to borrow for a specific term or against collateral. If they fail, investors and creditors lose money but not immediate access to cash. For this reason, the same level of supervision and regulation is not appropriate for both categories of institutions.

Finally, it is debatable whether regulation actually makes institutions safer or sounder. Markets, not regulators, first identified and acted upon the problems in the present crisis, and the failure rate of regulated institutions isn’t clearly lower than that of unregulated ones: Citigroup, after all, is probably the most heavily regulated and supervised institution on the planet. The current safety-and-soundness regulation of commercial banks has failed. Proposals for other kinds of institutions must take into account both their different risk profiles and the shortcomings of the way commercial banks are regulated.

Improving product transparency

So far, proposals for managing systemic risk lean toward a more vigilant monitoring of the global financial system and tighter supervision of institutions deemed systemically important. What is also needed is a much better understanding of how systemic risk develops and spreads. It may well be that risk is caused as much by products as by institutions.

At the heart of the current crisis were a clutch of products carrying opaque three-letter acronyms, such as ABS, CDO, CLO, SIV, and CDS. Neither the people who designed these products nor their purchasers fully understood them. Yet they poisoned the financial system, spreading silently but virally across the globe, mutating as they went, and reaching system-threatening size without attracting attention. Regulators have resisted interfering in the development or dissemination of these products, fearing that doing so would dampen the dynamism of capital markets. Yet much so-called innovation is aimed more at exploiting loopholes and skirting regulation than at meeting the needs of customers. Products of this kind are unnecessarily—deliberately—complex and opaque. The world of finance, as the economist John Kenneth Galbraith noted, “hails the invention of the wheel over and over again, often in a slightly more unstable form.”

Controls on product innovation don’t stifle other industries with potentially dangerous products. Pharmaceutical companies, for instance, can’t sell products—even to professional buyers—until they are rigorously tested and the trial results become available.

Perhaps the best way to manage the financial sector’s systemic risk is to put a brake on its carriers and require all products over a certain volume to be traded on an exchange rather than over the counter or, at a minimum, to create a mandatory central clearing house for them. This approach would make products simpler, more standardized, and more transparent, reducing the latent liquidity and counterparty risks that come to the fore in financial crises.

Determining ‘adequate capital’

By common consent, banks should hold more capital. How much and in what form are less straightforward questions. More capital makes the industry safer but also lowers returns and, by extension, probably raises prices for customers. It is critical to balance the need to control risks with the need for attractive returns.

Many proposals to strike that balance are encouraging. There is general agreement, for instance, that capital levels should be set counter-cyclically—in other words, institutions should build up higher levels in good times to form a bigger buffer in recessions. There are also ideas to complement the conventional risk-weighted capital targets with limits on leverage (assets divided by equity). Two metrics, whatever their individual merits, are better than one, since asking a bank to optimize on a single metric invites unproductive regulatory arbitrage.

Some proposals to replace the underlying risk models used to calculate capital are a matter of concern. The existing models, sophisticated as they are, couldn’t cope with the multiplicity of risks in the financial system—they underestimated counterparty, liquidity, and market risk, as well as the risk of rare, so-called Black Swan events. Consultants, academics, and economists have suggested ways to make such models even more sophisticated. While internal risk management might benefit from these ideas, it is more important to make the models for setting regulatory capital easily understood, objective, and, as John Maynard Keynes put it, “vaguely right rather than precisely wrong.”

The form of capital that banks should hold has been much less debated than the amount. Yet it may not be appropriate or efficient to carry equity capital against genuine “tail risk” (or extremely low-probability) events. After all, individuals don’t put aside sums of money in case their houses are struck by lightning. What’s more, when a bank suffers a sudden capital shock, it is very difficult to raise equity quickly, and the only real option is to sell assets, which in a nervous mark-to-market environment can weaken the capital ratios or collateral positions of other banks, creating a general fire-sale effect. What makes sense for a single bank is harmful for the system. We should explore how banks can protect themselves against tail risk by holding “contingent capital”—for instance, hybrid securities that start as debt and then convert automatically to equity if certain low-probability events occur.

Rethinking the supervision model

Regulating and supervising banks is difficult. Moreover, the greatest systemic risks occur in boom times, when the industry’s political support is strongest and oversight less popular. The answer is not just to hire additional regulators and pay them more. The model of supervision must be rethought fundamentally.

One possibility could be moving to enforcement based on rules rather than the prevailing “guidelines” approach. Particularly at the height of an economic boom, guidelines are very hard for regulators to enforce. In a system based on rules, the burden would be removed from regulators—for instance, if banks breached capital requirements, a set of previously agreed upon, nonnegotiable escalating responses could be triggered, starting at an earlier stage than they do today. They could include imposing tighter supervision, restricting dividends or bonus payments, or requiring debt-to-equity conversions until proper ratios were restored.

Another change of model could involve what Daniel Roth in Wired magazine called “radical transparency.”2 Financial institutions and other public companies now disclose their activities to investors after the fact, in lengthy reports that are neither granular nor synthesized enough to be insightful. Every year, the US Securities & Exchange Commission’s public-document database, Edgar, catalogs 200 gigabytes of filings, roughly 15 million pages of text—up from 35 gigabytes a decade ago. Regulators have greater access to information about companies than investors do but are even more overwhelmed by complex data. Despite all this disclosure, when market liquidity dried up in late 2007, nobody knew what institutions held which toxic assets. Roth’s proposal is to exploit the “wisdom of crowds” by forcing companies to report more detailed data, online, in real time, and—critically—uniformly tagged so they can be exported into spread-sheets for exploration and analysis. The massive, parallel-processing, and number-crunching power of curious, interested, and directly motivated people around the world would then undertake much of the supervision required.

Neither of these specific ideas may be right, but in the information age the supervision of a vital global industry should not depend on the herculean efforts of a few well-intentioned officials drowning in data and outnumbered and outgunned by profit-seeking bankers. The system can be smarter than that.

Achieving international cooperation

Financial markets have outgrown national boundaries and domestic regulatory systems, to the point where no nation can control its own fate. International claims on banks rose to $35 trillion last year, from $6 trillion in 1990. Massive flows take place not only in the well-understood international bond market but also in the interbank, securitization, derivatives, and cross-border-lending markets. Many of the effects are positive, but there is a high risk that problems will spread from country to country and that regulation’s unforeseen consequences in one will have an impact on another.

For these reasons, global regulation and supervision remain many years away—a reality the G-20 recognized when it refrained from calling for a global regulator. Instead, it proposed the creation of national colleges of supervisors to develop regulatory rules and of a financial stability board, the successor to the Financial Stability Forum (FSF), to monitor the global financial system and make recommendations to regulators and national governments. Pragmatic and quick agreement is needed to make this kind of cooperation work—for example, to decide how the colleges of supervisors will together develop common solutions and how individual countries will adopt them.

There must also be an honest debate about why existing monitors of systemic risk—the International Monetary Fund and the FSF—failed in their task. Were they unable to see the risk until it was too late, or were alarm bells drowned out by the bull market’s euphoria? Either way, changing the name of the FSF and exhorting it to be more vigilant or vocal will accomplish little. We need to decide if it needs greater scope to detect potential crises, more teeth, or both. Finally, despite fears of economic nationalism, there may be a need for greater regulation and supervision of foreign subsidiaries and branches by host countries until genuinely international regulation emerges. Few if any of the new regulations suggested for banks can be imposed in some large countries but not in others without triggering massive and counterproductive arbitrage. The mechanics of coordination and cooperation must be determined quickly.


A once-in-a-generation opportunity to redesign the global financial system is at hand. The broad direction of reform is clear, but the details are important and getting them wrong will prepare the way for the next financial failure. The design of reform should be careful and deliberate, based on a thorough analysis of the underlying problems. It should be sufficiently creative and innovative to provide solutions for the next 20 years instead of revising approaches that haven’t worked for the past 20. And it should tackle issues that are difficult politically, such as the protection of TBTF institutions.

Explore a career with us